{"id":"CVE-2020-37288","aliases":["EUVD-2020-31284","GHSA-4c59-5jcg-7qq8","GHSA-vg88-3v92-rjx2"],"status":"published","title":"Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops","description":"Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00347,"percentile":0.28493,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-670","CWE-691"],"published":"2026-10-06T15:20:10Z","modified":"2026-10-24T02:56:09Z","fixes":[{"ecosystem":"PyPI","package":"vyper","fixed_in":["0.2.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"vyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0b10"},{"fixed":"0.2.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"vyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0b10"},{"fixed":"0.2.3"}]}],"versions":["0.1.0b10","0.1.0b11","0.1.0b12","0.1.0b13","0.1.0b14","0.1.0b15","0.1.0b16","0.1.0b17","0.2.1","0.2.2"]}],"products":[{"vendor":"vyperlang","product":"vyper"}],"references":[{"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/vyper-0.1-0b10-before-0.2.3-invalid-jump-destination-via-return-in-nested-loops","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37288"},{"url":"https://github.com/advisories/GHSA-4c59-5jcg-7qq8"},{"url":"https://github.com/vyperlang/vyper/pull/2110","tags":["web"]},{"url":"https://github.com/vyperlang/vyper/commit/a1d92e5eb968a34a23850359656aee23334adb90","tags":["web"]},{"url":"https://github.com/vyperlang/vyper/releases/tag/v0.2.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vg88-3v92-rjx2"},{"url":"https://github.com/vyperlang/vyper","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-37288","title":"Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops","description":"Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.","status":"published","published":"2026-10-21T00:36:16.926Z","modified":"2026-10-21T15:51:17.564Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:35:47.22408Z"}],"euvd":[{"id":"EUVD-2020-31284","description":"Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.","status":"published","published":"2026-10-21T00:36:16Z","modified":"2026-10-21T15:51:17Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:36.721365Z"}],"ghsa":[{"id":"GHSA-4c59-5jcg-7qq8","title":"Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for...","description":"Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.","status":"published","published":"2026-10-21T03:32:12Z","modified":"2026-10-21T03:32:16Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T15:14:08.480034Z"},{"id":"GHSA-vg88-3v92-rjx2","title":"Vyper: Return inside for loop more than 1 level deep","description":"# VVE-2020-0002\nEarlier today, we received a responsible disclosure of a potential issue from @michwill (developer of @curvefi) for Vyper users who use return statements inside for loops of nested internal calls. Returning inside a for loop causes an invalid jump dest, reverting the transaction unnecessarily.\n\nMWE:\n```python\n@internal\ndef _baz():\n    for i in range(1):\n        return  # Stack underflow happens here\n\n@internal\ndef _bar():\n    self._baz()\n\n@external\ndef foo():\n    self._bar()\n```\n\n### Impact\nImpact is minor, it is unlikely a user would encounter this problem unless they were working with nested calls, and return statements inside calls. Even in that scenario, you would encounter a revert which should be noticeable with adequate testing. In limited circumstances, this could cause a DoS attack for public contracts under certain conditions.\n\n### Patches\nFixed in https://github.com/vyperlang/vyper/pull/2110. Please upgrade to [Vyper 0.2.3](https://pypi.org/project/vyper/)\n\n### Workarounds\nNot returning inside a for loop nested 2+ internal calls deep works as is:\n```python\n@internal\ndef _baz():\n    for i in range(1):\n        pass\n    return  # This works fine\n\n@internal\ndef _bar():\n    self._baz()\n\n@external\ndef foo():\n    self._bar()\n```\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Chat with us in [our gitter ](https://gitter.im/vyperlang/community)\n* Open an issue in [https://github.com/vyperlang/vyper](https://github.com/vyperlang/vyper)\n* Email us at [security@vyperlang.org](mailto:security@vyperlang.org)","status":"published","published":"2026-10-06T15:20:10Z","modified":"2026-10-06T15:20:13Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-691"],"updated_at":"2026-11-02T14:41:27.036917Z"}],"nvd":[{"id":"CVE-2020-37288","description":"Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.","status":"published","published":"2026-10-21T01:17:18.683Z","modified":"2026-10-22T17:39:56.76Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:06:48.879919Z"}],"osv":[{"id":"CVE-2020-37288","description":"Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.","status":"published","published":"2026-10-21T01:17:18.683Z","modified":"2026-10-24T02:45:09.587843433Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"GHSA-vg88-3v92-rjx2","title":"Vyper: Return inside for loop more than 1 level deep","description":"# VVE-2020-0002\nEarlier today, we received a responsible disclosure of a potential issue from @michwill (developer of @curvefi) for Vyper users who use return statements inside for loops of nested internal calls. Returning inside a for loop causes an invalid jump dest, reverting the transaction unnecessarily.\n\nMWE:\n```python\n@internal\ndef _baz():\n    for i in range(1):\n        return  # Stack underflow happens here\n\n@internal\ndef _bar():\n    self._baz()\n\n@external\ndef foo():\n    self._bar()\n```\n\n### Impact\nImpact is minor, it is unlikely a user would encounter this problem unless they were working with nested calls, and return statements inside calls. Even in that scenario, you would encounter a revert which should be noticeable with adequate testing. In limited circumstances, this could cause a DoS attack for public contracts under certain conditions.\n\n### Patches\nFixed in https://github.com/vyperlang/vyper/pull/2110. Please upgrade to [Vyper 0.2.3](https://pypi.org/project/vyper/)\n\n### Workarounds\nNot returning inside a for loop nested 2+ internal calls deep works as is:\n```python\n@internal\ndef _baz():\n    for i in range(1):\n        pass\n    return  # This works fine\n\n@internal\ndef _bar():\n    self._baz()\n\n@external\ndef foo():\n    self._bar()\n```\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Chat with us in [our gitter ](https://gitter.im/vyperlang/community)\n* Open an issue in [https://github.com/vyperlang/vyper](https://github.com/vyperlang/vyper)\n* Email us at [security@vyperlang.org](mailto:security@vyperlang.org)","status":"published","published":"2026-10-06T15:20:10Z","modified":"2026-10-24T02:56:09.007506586Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-691"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}